@antzsoft/chat-core 1.3.6 → 1.3.7

package/README.md

@@ -3056,6 +3056,22 @@ document.querySelectorAll('[data-conv-id]').forEach((el) => {
 
 ## Changelog
 
+### v1.3.7
+
+- **Docs only — no code changes.** Brought the docs fully up to date: added the missing
+  release notes to `docs/integration-guide.html` (its "What's New" section had stopped at
+  v1.3.4) so both the README changelog and the HTML integration guide now cover v1.3.5,
+  v1.3.6, and this v1.3.7 entry. No SDK behaviour changed in this version; upgrading from
+  1.3.6 is a no-op at runtime.
+
+### v1.3.6
+
+- **Fix: `reconnectSocket` now PRESERVES the transit session instead of recreating it** — follow-up to the 1.3.5 reconnect fix. 1.3.5 fixed `"Transit encryption required"` by disconnecting and re-running the full `connectSocket()` handshake, but that also cleared the cached transit session (the `'disconnect'` handler calls `clearTransitSession()`) and established a brand-new one with a new session key. Server-broadcast events (e.g. `user_online`) are encrypted with the session the server still holds, so a fresh client key could not decrypt them → continuous `"Transit decryption failed for event: user_online"`.
+
+  `reconnectSocket` is a token-only refresh — the transit session is still valid on the server (stored in Redis by `sessionId`, re-linked to the new socket on reconnect). So it now carries the existing `transitSessionId` forward in the handshake auth and reconnects the **same** socket **without** disconnecting, keeping the client's session key intact. The server re-links the same session (`getBySessionId` + `linkSocket`), so both sides keep the same key and decryption continues to work. Falls back to the full `connectSocket()` flow only when there is no valid cached session to preserve.
+
+  Net: keeps 1.3.5's "no more `Transit encryption required` on reconnect" while removing the `user_online` decryption-failure regression. **No integration changes required.**
+
 ### v1.3.5
 
 - **Fix: `reconnectSocket()` no longer drops the transit-encryption handshake** — when transit encryption is enabled, `reconnectSocket()` now delegates to the full `connectSocket()` flow instead of doing a bare `_socket.auth` swap. `reconnectSocket()` predates transit encryption and was never migrated: it overwrote `_socket.auth` with only `{ token, userId, tenantId }`, dropping the `transitSessionId` / `transitEphemeralPub` fields that `connectSocket()` sets during the handshake. Combined with the `'disconnect'` handler clearing the cached transit session, a reconnect after the socket had disconnected (e.g. app returning to foreground on iOS/Android, where backgrounding fully disconnects) went out with no transit auth and no cached session → the server rejected the handshake with **"Transit encryption required: missing transitEphemeralPub/transitAlgo in handshake auth"**. It was intermittent — fast devices whose cached transit session survived the reconnect were unaffected.

package/docs/integration-guide.html

@@ -155,7 +155,7 @@ section.sec>h2:hover{color:#fff}
 
   <div class="section-label">What's New</div>
   <ul>
-    <li><a href="#whats-new">v1.3.4 Release Notes</a></li>
+    <li><a href="#whats-new">v1.3.7 Release Notes</a></li>
   </ul>
 
   <div class="section-label">Getting Started</div>
@@ -250,12 +250,85 @@ section.sec>h2:hover{color:#fff}
   <h2>What's New</h2>
   <p style="color:var(--muted);font-size:13px;margin-bottom:20px">Version history and release notes. Click a version to expand.</p>
 
-  <!-- ── v1.3.4 (current) ── -->
+  <!-- ── v1.3.7 (current) ── -->
+  <div class="wn-version open" id="wn-137">
+    <div class="wn-header" onclick="toggleVersion('wn-137')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.7</span>
+        <span class="wn-badge current">Current</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+      <div class="wn-item" id="wn-137-docs">
+        <div class="wn-item-header" onclick="toggleItem('wn-137-docs')">
+          <span class="wn-tag fix">Docs</span>
+          <span class="wn-item-title">Documentation brought up to date (no code changes)</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p>This "What's New" section had stopped at v1.3.4. It now includes the v1.3.5 and v1.3.6 reconnect/transit fixes below, and this v1.3.7 entry. <strong>No SDK behaviour changed in 1.3.7</strong> — upgrading from 1.3.6 is a runtime no-op.</p>
+        </div>
+      </div>
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.6 ── -->
+  <div class="wn-version open" id="wn-136">
+    <div class="wn-header" onclick="toggleVersion('wn-136')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.6</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+      <div class="wn-item" id="wn-136-transit-preserve">
+        <div class="wn-item-header" onclick="toggleItem('wn-136-transit-preserve')">
+          <span class="wn-tag fix">Fix</span>
+          <span class="wn-item-title"><code>reconnectSocket</code> preserves the transit session instead of recreating it</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p>Follow-up to the v1.3.5 reconnect fix. v1.3.5 fixed <code>"Transit encryption required"</code> by disconnecting and re-running the full <code>connectSocket()</code> handshake — but that also cleared the cached transit session (the <code>'disconnect'</code> handler calls <code>clearTransitSession()</code>) and established a brand-new one with a new session key. Server-broadcast events (e.g. <code>user_online</code>) are encrypted with the session the server still holds, so a fresh client key could not decrypt them, producing continuous <code>"Transit decryption failed for event: user_online"</code>.</p>
+          <p><code>reconnectSocket</code> is a token-only refresh — the transit session is still valid on the server (stored in Redis by <code>sessionId</code>, re-linked to the new socket on reconnect). It now carries the existing <code>transitSessionId</code> forward in the handshake auth and reconnects the <strong>same</strong> socket <strong>without</strong> disconnecting, keeping the client's session key intact. The server re-links the same session, so both sides keep the same key and decryption keeps working. Falls back to the full <code>connectSocket()</code> flow only when there is no valid cached session to preserve (e.g. the socket was already disconnected).</p>
+          <p><strong>No integration changes required.</strong> Keeps v1.3.5's "no more <code>Transit encryption required</code> on reconnect" while removing the <code>user_online</code> decryption-failure regression.</p>
+        </div>
+      </div>
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.5 ── -->
+  <div class="wn-version open" id="wn-135">
+    <div class="wn-header" onclick="toggleVersion('wn-135')">
+      <div class="wn-title">
+        <span class="wn-ver">v1.3.5</span>
+        <span class="wn-date">July 2026</span>
+      </div>
+      <span class="wn-chevron">▲</span>
+    </div>
+    <div class="wn-body">
+      <div class="wn-item" id="wn-135-transit-reconnect">
+        <div class="wn-item-header" onclick="toggleItem('wn-135-transit-reconnect')">
+          <span class="wn-tag fix">Fix</span>
+          <span class="wn-item-title"><code>reconnectSocket</code> no longer drops the transit-encryption handshake</span>
+          <span class="wn-chevron-sm">▾</span>
+        </div>
+        <div class="wn-item-body">
+          <p><code>reconnectSocket</code> predates transit encryption and was never migrated: it overwrote <code>_socket.auth</code> with only <code>{ token, userId, tenantId }</code>, dropping the <code>transitSessionId</code> / <code>transitEphemeralPub</code> fields that <code>connectSocket()</code> sets during the handshake. Combined with the <code>'disconnect'</code> handler clearing the cached transit session, a reconnect after the socket had disconnected (e.g. app returning to foreground on iOS/Android, where backgrounding fully disconnects) went out with no transit auth and no cached session, so the server rejected the handshake with <code>"Transit encryption required: missing transitEphemeralPub/transitAlgo in handshake auth"</code>. Intermittent — fast devices whose cached transit session survived the reconnect were unaffected.</p>
+          <p>When transit encryption is on, <code>reconnectSocket</code> now delegates to the full <code>connectSocket()</code> flow (re-establishes/reuses the transit session, rebuilds the handshake auth) instead of a bare auth-swap. It also inherits <code>connectSocket()</code>'s in-flight dedupe, so multiple rapid reconnect calls collapse into one. Non-transit deployments keep the original fast bare auth-swap path unchanged.</p>
+          <p><strong>Note:</strong> v1.3.5 introduced a follow-on regression (see v1.3.6) — prefer <strong>1.3.6+</strong>. <strong>No integration changes required</strong> — same <code>reconnectSocket(token, userId, tenantId)</code> signature.</p>
+        </div>
+      </div>
+    </div>
+  </div><!-- /.wn-version -->
+
+  <!-- ── v1.3.4 ── -->
   <div class="wn-version open" id="wn-134">
     <div class="wn-header" onclick="toggleVersion('wn-134')">
       <div class="wn-title">
         <span class="wn-ver">v1.3.4</span>
-        <span class="wn-badge current">Current</span>
         <span class="wn-date">July 2026</span>
       </div>
       <span class="wn-chevron">▲</span>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antzsoft/chat-core",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "Platform-agnostic core for Antz Chat — API, socket, stores, types. Works in browser, React Native (Expo or bare), and Node.js.",
   "author": "Antz",
   "license": "MIT",